Authorize Device from Entra Group

IanTonyBirchall — Tue, 02 Dec 2025 12:26:38 GMT

I am running ISE 3.4 Patch 4
I have a condition that says

If RESTEntraIDStore: External Groups
Equals "MyEntraSecurityGroup" Permit access

I know this should be possible from Patch 4 or 3.5 onwards.
The device is definitely in the Entra Group,
For the Rest store i am using the Device ID within the device Query setting.

within my test I can see the following

15048

Queried PIP - RESTEntraIDStore.ExternalGroups

But it then just moves on having not found anything. hitting the default Authz rule.
Not sure where this could possibly be going wrong.

Any help would be greatly appreciated.

Re: Authorize Device from Entra Group

Greg Gibbs — Tue, 02 Dec 2025 21:23:02 GMT

There is not much detail here to go on, but it looks like you might be using the wrong Dictionary. For device lookups, you should be using the 'RESTEntraIDStoreDevice:External Groups' as stated in the Admin Guide and my blog here - https://cs.co/ise-entraid#DeviceQuery

topic Re: Authorize Device from Entra Group in Network Access Control

Authorize Device from Entra Group

Re: Authorize Device from Entra Group